#!/usr/bin/perl

use strict;
use warnings;

my %hash;

while(<DATA>)
{
   next if /^\s*$/;     #skip blank lines (optional)
   my ($srcip, $action_field) = (split /\s+/,$_)[1,4];
   (my $action) = $action_field =~ m/([A-Za-z]+)/;

   $hash{$srcip}{$action}++;
}

foreach my $ip (keys %hash)
{
   print "$ip\n" if (      $hash{$ip}{'sent'} 
                      and !$hash{$ip}{'created'} );
}

#prints: 192.168.7.16

__DATA__
ex100525.log:09:42:26 192.168.66.176 webcountry 192.168.0.166 [5933]created /140NOE77111_V460_+IE38/FTP+script/put771.ftp 226 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]created /140NOE77111_V460_+IE38/FTP+script/update_noe77111_module.doc 226 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]created /140NOE77111_V460_+IE38/FTP+script/upfwnoe.bat 226 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]CWD /140NOE77111_V460_+IE38/Release+Note 550 2
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]CWD /140NOE77111_V460_+IE38/Release+Note 250 0
ex100525.log:09:42:27 192.168.66.176 webcountry 192.168.0.166 [5933]sent /140NOE77111_V460_+IE38/Release+Note/RN_140NOE77111_V46.doc 226 0
ex100525.log:09:42:27 192.168.7.16 webcountry 192.168.0.166 [5933]sent /140NOE77111+V4.6/140NOE77111_V460_+IE38 250 0
ex100525.log:09:42:27 192.168.7.16 webcountry 192.168.0.166 [5933]CWD /140NOE77111+V4.6/140NOE77111_V460_+IE38 250 0